Encryption with Gnu Privacy Guard (GPG)(digital-era.net) |
Encryption with Gnu Privacy Guard (GPG)(digital-era.net) |
I wonder how would one encrypt a conversation between say 15 people.
gpg -e -r recipient1@example.com -r recipient2@example.com
That products some ciphertext which can be decrypted by either recipient.
If you get a new public key for someone, and it's signed by someone else you don't know (most of the time this is the case) are you going to bother to utilise that signature to increase the trust? No. Are you going to assume increased trust somehow regardless? Yes. FAIL.
Modify it further, if it is signed by someone you do know what are the chances your UI is going to give you any sort of indication that this is more trusted that other message workflows? And if it doesn't give you any indication (most leave it up to you to check) who's gonna bother to look just passed "your friend <yourfiendsname@company>" ASCII and actually check the key? no one. FAIL.
PGP WoT fails miserably.
On a related note, I have a hard time understanding why a web site talking about digital security also doesn't have a certificate.
This may be true (I really have no idea) but isn't it like travelling on a highway at night with your normal lights turned off because you have a better system based on infrared? After reading about the story of that guy who hacked into a computer by MITMing the notepad++ site, I became even more convinced that all pages must have certificates. Nowadays it's also possible to get a basic ssl cert for free, I can't figure out what the catch is really.
gpg -o encrypted_file.gpg –encrypt -r original.file
gpg -e file
The output will be file.gpg. It will ask you for a recipient unless you have "default-recipient" or "default-recipient-selt" set in gpg.conf.
"encrypt-to YOUR_KEY_ID"
in your gpg.conf
This is especially significant if the recipients have different sized public keys. If you send a message to a 2048-bit key and a 1024-bit key, the message only has 1024 bits of security. So you really do get a weakest link effect.
Maybe I am mistaken or maybe there's a way to do that without having multiple keyrings or something, but that's kind of the problem. It's really hard to tell what I would or would not be sharing because there's no "interface" to speak of and I am hardly an expert.
If the author meant actually sending someone a email to see that it is indeed owned by them remotely: NO WAY. Does not work:
me: "hey, just sending you an email to confirm its really you before sending the secret plans?"
them: "yeah, its me. send the plans."
That is exactly what WoT tries to solve but can't due to misuse.
What kind of attacks is this practice vulnerable to?
I want to pretend to control target@example.com and the legitimate owner of this address is an OpenPGP user who has published a keyring on the public keyservers.
1) I create a keyring and add a single uid with my real name and target@example.com
2) I download the public keyring for the legitimate user target@example.com and extract the encryption subkey.
3) Even though I don't know the private key I can add this public key as the encryption subkey to the keyring created in step #1.
4) I publish this keyring on the public keyservers so that you will find it by querying the fingerprint I give you when we meet.
5) You send email to the real user target@example.com which they are able to decrypt and respond to. Of course there could be some confusion since the real user is not expecting an email which presumably talks about verifying keys.
6) Since the mail was decrypted and responded to, you sign the key and return it to me.
7) I revoke the certification on the encryption subkey I borrowed from the real user and add a new encryption key which I create.
8) People who trust your signature encrypt mail to target@example.com with the false key I've published.
> What kind of attacks is this practice vulnerable to?
So long as the trust only translates to the very limited use cases then there is no vulnerability. Those limits basically mean that no trust should be assumed by anyone that did not participate in the WoT in question. This particular style of WoT means anyone wanting to retain anonymity needs to skip it, or am i missing something?
Mainly I think all WoT models i've seen thus far are too susceptible to sybil attacks (impersonation) and as a result instill bad habits.
you only need to look at people use of pgp today to see how much WoT's would be a failure if used. pgp.mit.edu still aint got ssl. journalists are linking to nonssl links for their key via twitter t.to urls